CVE-2026-34036

Katalog CVE

CVSS 6.5 · Medium EPSS 1,5%

Kerentanan Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') pada dolibarr erp/crm. Skor CVSS 3.1 6.5 (Medium) menurut github.com.

Deskripsi (NVD)

Dolibarr is an enterprise resource planning (ERP) and customer relationship management (CRM) software package. In versions 22.0.4 and prior, there is a Local File Inclusion (LFI) vulnerability in the core AJAX endpoint /core/ajax/selectobject.php. By manipulating the objectdesc parameter and exploiting a fail-open logic flaw in the core access control function restrictedArea(), an authenticated user with no specific privileges can read the contents of arbitrary non-PHP files on the server (such as .env, .htaccess, configuration backups, or logs…). At time of publication, there are no publicly available patches.

Rincian

Terbit di NVD

31 Maret 2026

Terakhir diubah

7 Oktober 2026

Status NVD

Analyzed

CVSS 3.1

6.5 (Medium), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-98: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')

EPSS (30 hari)

1,5% peluang dieksploitasi; lebih tinggi dari 73,0% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/Dolibarr/dolibarr/security/advisories/GHSA-2mfj-r695-5h9r exploit · mitigasi · advisory vendor
• https://github.com/Dolibarr/dolibarr/commit/743c22e57c0b2a017d6b92bec865d71ce6177a6a patch